feat(mcv): add --no-gpu support for cache creation without GPU hardware

.github/workflows/image-build.yml

@@ -35,6 +35,7 @@ jobs:
             image: operator
             dockerfile: ./Containerfile.gkm-operator
             context: .
+            platforms: linux/amd64
             tags: |
               type=ref,event=branch
               type=ref,event=tag
@@ -43,33 +44,77 @@ jobs:
               # set latest tag for default branch
               type=raw,value=latest,enable={{is_default_branch}}
 
+          # Agent unified: NVIDIA + AMD GPU support; :latest points here for backward compat
           - registry: quay.io
             repository: gkm
             image: agent
-            dockerfile: ./Containerfile.gkm-agent
+            variant: unified
+            dockerfile: ./Containerfile.gkm-agent.unified
             context: .
+            platforms: linux/amd64
             tags: |
+              type=ref,event=branch,suffix=-unified
+              type=ref,event=tag,suffix=-unified
+              type=ref,event=pr,suffix=-unified
+              type=sha,format=long,suffix=-unified
+              type=raw,value=unified,enable={{is_default_branch}}
               type=ref,event=branch
               type=ref,event=tag
               type=ref,event=pr
               type=sha,format=long
-              # set latest tag for default branch
               type=raw,value=latest,enable={{is_default_branch}}
 
+          # Agent no-gpu: no CUDA/ROCm libraries, for arm64/mac/CI environments
+          - registry: quay.io
+            repository: gkm
+            image: agent
+            variant: no-gpu
+            dockerfile: ./Containerfile.gkm-agent.no-gpu
+            context: .
+            platforms: linux/amd64,linux/arm64
+            tags: |
+              type=ref,event=branch,suffix=-no-gpu
+              type=ref,event=tag,suffix=-no-gpu
+              type=ref,event=pr,suffix=-no-gpu
+              type=sha,format=long,suffix=-no-gpu
+              type=raw,value=no-gpu,enable={{is_default_branch}}
+
+          # GKM Extract unified: NVIDIA + AMD GPU support; :latest points here for backward compat
           - registry: quay.io
             repository: gkm
             image: gkm-extract
-            dockerfile: ./Containerfile.gkm-extract
+            variant: unified
+            dockerfile: ./Containerfile.gkm-extract.unified
             context: .
+            platforms: linux/amd64
             tags: |
+              type=ref,event=branch,suffix=-unified
+              type=ref,event=tag,suffix=-unified
+              type=ref,event=pr,suffix=-unified
+              type=sha,format=long,suffix=-unified
+              type=raw,value=unified,enable={{is_default_branch}}
               type=ref,event=branch
               type=ref,event=tag
               type=ref,event=pr
               type=sha,format=long
-              # set latest tag for default branch
               type=raw,value=latest,enable={{is_default_branch}}
 
-    name: Build Image (${{ matrix.image.image }})
+          # GKM Extract no-gpu: no CUDA/ROCm libraries, for arm64/mac/CI environments
+          - registry: quay.io
+            repository: gkm
+            image: gkm-extract
+            variant: no-gpu
+            dockerfile: ./Containerfile.gkm-extract.no-gpu
+            context: .
+            platforms: linux/amd64,linux/arm64
+            tags: |
+              type=ref,event=branch,suffix=-no-gpu
+              type=ref,event=tag,suffix=-no-gpu
+              type=ref,event=pr,suffix=-no-gpu
+              type=sha,format=long,suffix=-no-gpu
+              type=raw,value=no-gpu,enable={{is_default_branch}}
+
+    name: Build Image (${{ matrix.image.image }}${{ matrix.image.variant && format('-{0}', matrix.image.variant) || '' }})
     steps:
       # Set a `push_flag`. This is only true if the github action is a push and the repository
       # organization is `redhat-et`. This keeps credential fails from occurring on push to forks.
@@ -121,17 +166,15 @@ jobs:
         id: build-push-image
         uses: docker/build-push-action@v7
         with:
-          platforms: linux/amd64
-          # platforms: linux/amd64, linux/arm64, linux/ppc64le, linux/s390x
-          # builds with rocm will fail on linux/arm64
+          platforms: ${{ matrix.image.platforms }}
           push: ${{ fromJSON(steps.set-push.outputs.push_flag) }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           file: ${{ matrix.image.dockerfile }}
           build-args: BUILDPLATFORM=linux/amd64
           context: ${{ matrix.image.context }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: type=gha,scope=${{ matrix.image.image }}-${{ matrix.image.variant || 'default' }}
+          cache-to: type=gha,mode=max,scope=${{ matrix.image.image }}-${{ matrix.image.variant || 'default' }}
 
       - name: Sign the images with GitHub OIDC Token
         if: ${{ fromJSON(steps.set-push.outputs.push_flag) }}

.github/workflows/mcv-build-image.yml

@@ -27,20 +27,40 @@ jobs:
       fail-fast: false
       matrix:
         image:
+          # Unified variant: NVIDIA (CUDA/NVML) + AMD (ROCm) support with auto-detection
           - registry: quay.io
             repository: gkm
             image: mcv
-            dockerfile: ./mcv/images/amd64.dockerfile
+            variant: unified
+            target: mcv-unified
+            dockerfile: ./mcv/images/Containerfile
             context: .
+            platforms: linux/amd64
             tags: |
-              type=ref,event=branch
-              type=ref,event=tag
-              type=ref,event=pr
-              type=sha,format=long
-              # set latest tag for default branch
+              type=ref,event=branch,suffix=-unified
+              type=ref,event=tag,suffix=-unified
+              type=ref,event=pr,suffix=-unified
+              type=sha,format=long,suffix=-unified
+              type=raw,value=unified,enable={{is_default_branch}}
+          # No-GPU variant: no CUDA/ROCm libraries, for arm64/mac/CI environments
+          # :latest always resolves to the no-gpu variant (lighter, safer default)
+          - registry: quay.io
+            repository: gkm
+            image: mcv
+            variant: no-gpu
+            target: mcv-minimal
+            dockerfile: ./mcv/images/Containerfile
+            context: .
+            platforms: linux/amd64,linux/arm64
+            tags: |
+              type=ref,event=branch,suffix=-no-gpu
+              type=ref,event=tag,suffix=-no-gpu
+              type=ref,event=pr,suffix=-no-gpu
+              type=sha,format=long,suffix=-no-gpu
+              type=raw,value=no-gpu,enable={{is_default_branch}}
               type=raw,value=latest,enable={{is_default_branch}}
 
-    name: Build Image (${{ matrix.image.image }})
+    name: Build Image (${{ matrix.image.image }}-${{ matrix.image.variant }})
     steps:
       # Set a `push_flag`. This is only true if the github action is a push and the repository
       # organization is `redhat-et`. This keeps credential fails from occurring on push to forks.
@@ -92,15 +112,16 @@ jobs:
         id: build-push-image
         uses: docker/build-push-action@v7
         with:
-          platforms: linux/amd64
+          platforms: ${{ matrix.image.platforms }}
           push: ${{ github.event_name == 'push' && fromJSON(steps.set-push.outputs.push_flag) }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           file: ${{ matrix.image.dockerfile }}
+          target: ${{ matrix.image.target }}
           build-args: BUILDPLATFORM=linux/amd64
           context: ${{ matrix.image.context }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: type=gha,scope=${{ matrix.image.image }}-${{ matrix.image.variant }}
+          cache-to: type=gha,mode=max,scope=${{ matrix.image.image }}-${{ matrix.image.variant }}
 
       - name: Sign the images with GitHub OIDC Token
         if: ${{ fromJSON(steps.set-push.outputs.push_flag) }}

Containerfile.gkm-agent.no-gpu

@@ -0,0 +1,52 @@
+# Build the agent binary
+FROM golang:1.25-trixie AS builder
+
+WORKDIR /workspace
+
+# Install required system packages
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        libgpgme-dev \
+        btrfs-progs \
+        libbtrfs-dev \
+        libgpgme11-dev \
+        libseccomp-dev \
+        pkg-config \
+        build-essential && \
+    apt-get clean && rm -rf /var/lib/apt/lists/*
+
+# Copy the Go Modules manifests
+COPY go.mod go.mod
+COPY go.sum go.sum
+
+# Copy the go source
+COPY agent/main.go agent/main.go
+COPY api/ api/
+COPY pkg/ pkg/
+COPY internal/controller/ internal/controller/
+COPY vendor/ vendor/
+COPY Makefile Makefile
+
+# Build the agent binary
+RUN make build-gkm-agent
+
+# No GPU runtime - debian:trixie-slim matches golang:1.25-trixie (glibc 2.38+).
+# No CUDA or ROCm libraries; GPU detection is disabled at runtime via --no-gpu flag.
+FROM debian:trixie-slim
+
+COPY --from=builder /workspace/bin/gkm-agent /agent
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        ca-certificates \
+        libgpgme11t64 \
+        libbtrfs0t64 \
+        libffi8 \
+        libc6 \
+        libseccomp2 && \
+    apt-get clean && rm -rf /var/lib/apt/lists/*
+
+# Run as non-root (no GPU device access required in no-gpu mode)
+USER 65532:65532
+
+ENTRYPOINT ["/agent"]

Containerfile.gkm-agent.unified

@@ -0,0 +1,78 @@
+# Build the agent binary
+FROM public.ecr.aws/docker/library/golang:1.25 AS builder
+
+WORKDIR /workspace
+
+# Install required system packages
+RUN apt-get update && \
+    apt-get install -y \
+        libgpgme-dev \
+        btrfs-progs \
+        libbtrfs-dev \
+        libgpgme11-dev \
+        libseccomp-dev \
+        pkg-config \
+        build-essential && \
+    apt-get clean
+
+# Copy the Go Modules manifests
+COPY go.mod go.mod
+COPY go.sum go.sum
+
+# Copy the go source
+COPY agent/main.go agent/main.go
+COPY api/ api/
+COPY pkg/ pkg/
+COPY internal/controller/ internal/controller/
+COPY vendor/ vendor/
+COPY Makefile Makefile
+
+# Build the agent binary
+RUN make build-gkm-agent
+
+# NVIDIA CUDA base provides libnvidia-ml.so.1 for NVIDIA GPU detection via NVML.
+# ROCm tools (amd-smi, rocm-smi) are installed for AMD GPU detection.
+# A single image supports both GPU vendors; auto-detection occurs at runtime.
+FROM nvcr.io/nvidia/cuda:12.6.3-base-ubuntu24.04
+
+COPY --from=builder /workspace/bin/gkm-agent /agent
+
+ARG TARGETARCH
+ARG ROCM_VERSION=7.0.1
+ARG AMDGPU_VERSION=7.0.1.70001
+
+# Install runtime dependencies (Ubuntu 24.04 / noble package names)
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        ca-certificates \
+        libgpgme11t64 \
+        libbtrfs0 \
+        libffi8 \
+        libc6 \
+        libseccomp2 \
+        hwdata && \
+    apt-get clean && rm -rf /var/lib/apt/lists/*
+
+# Install ROCm for AMD GPU detection (amd64 only; ROCm has no arm64 packages).
+# On arm64 the image still provides NVIDIA/NVML support via the CUDA base.
+# Using Ubuntu 22.04 (jammy) packages as ROCm does not yet officially support Ubuntu 24.04.
+RUN if [ "$TARGETARCH" = "amd64" ]; then \
+    apt-get update && \
+    apt-get install -y --no-install-recommends \
+        wget pciutils gnupg2 python3-setuptools python3-wheel \
+        curl dialog rsync lsb-release software-properties-common && \
+    rm -rf /var/lib/apt/lists/* && \
+    wget https://repo.radeon.com/amdgpu-install/${ROCM_VERSION}/ubuntu/jammy/amdgpu-install_${AMDGPU_VERSION}-1_all.deb && \
+    apt-get update && \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y ./*.deb && \
+    apt-get update && \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends amd-smi-lib rocm-smi-lib && \
+    apt-get clean && rm -rf /var/lib/apt/lists/* ./*.deb && \
+    ln -s /opt/rocm-${ROCM_VERSION}/bin/amd-smi /usr/bin/amd-smi && \
+    ln -s /opt/rocm-${ROCM_VERSION}/bin/rocm-smi /usr/bin/rocm-smi; \
+fi
+
+# Runs as root: GPU device files (/dev/kfd, /dev/dri) require group membership
+# that is not available in the 65532 nonroot user; root is the practical choice
+# for containers that must detect AMD/NVIDIA hardware at runtime.
+ENTRYPOINT ["/agent"]